Proxmark3: Useful commands - Revision history

Ikramer at 18:34, 12 March 2024

2024-03-12T18:34:21Z

← Older revision		Revision as of 18:34, 12 March 2024
Line 179:		Line 179:

	[[Category:Documentation]]		[[Category:Documentation]]
			[[Category:Pentesting]]

Silvie: Protected "Proxmark3: Useful commands" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

2021-03-19T15:06:46Z

Protected "Proxmark3: Useful commands" ([Edit=Allow only administrators] (indefinite) [Move=Allow only administrators] (indefinite))

← Older revision	Revision as of 15:06, 19 March 2021
(No difference)

Jostrowski: typo

2020-01-30T10:14:02Z

typo

← Older revision		Revision as of 10:14, 30 January 2020
Line 8:		Line 8:

	Please see the [[Proxmark3: Installation]] guide for a full overview of requirements.		Please see the [[Proxmark3: Installation]] guide for a full overview of requirements.
	However, the Operating systems on which we tested the installation on are:		However, the Operating systems on which we tested the installation are:
	*Ubuntu 16.04/18.03		*Ubuntu 16.04/18.03
	*Windows 10		*Windows 10
Line 15:		Line 15:
	In order to complete the "Introduction" described below, you have to complete the [[Proxmark3: Installation]] guide first.		In order to complete the "Introduction" described below, you have to complete the [[Proxmark3: Installation]] guide first.

	~~These~~ overview is based on the proxmark3 client, published on Github on the 29. May 2019		This overview is based on the proxmark3 client, published on Github on the 29. May 2019

	== Introduction ==		== Introduction ==

	This introduction should only give you a glimpse of the available commands and possibilities of the Proxmark3. The official Proxmark3-Repository as well as the more advanced Ice-Man-Fork Repository (both linked in the reference section) provide lots of functions, though most of them are still in their alpha stage and therefore still need a bit of tinkering in order to work well. For further commands and our security analysis of our university feel free to have a look at our documentation!		This introduction should only give you a glimpse of the available commands and possibilities of the Proxmark3. The official Proxmark3-Repository, as well as the more advanced Ice-Man-Fork Repository (both linked in the reference section), provide lots of functions, though most of them are still in their alpha stage and therefore still need a bit of tinkering in order to work well. For further commands and our security analysis of our university feel free to have a look at our documentation!

	=== The Commands ===		=== The Commands ===
Line 114:		Line 114:
	snoop <samples to skip (10000)> <triggers to skip (1)> Generic HF Snoop		snoop <samples to skip (10000)> <triggers to skip (1)> Generic HF Snoop

	Most of these command-options are for specific cards from specific manufacturers (e.g. legic, iclass, mf). On the other hand 14a is a NFC card standard that describes low level communication of smart cards. Not all follow the same standard and some implement proprietary protocols. The Mifare cards are built upon the 14a standard and have additional commands which can be found in their specific directory.		Most of these command-options are for specific cards from specific manufacturers (e.g. legic, iclass, mf). On the other hand, 14a is an NFC card standard that describes low-level communication of smart cards. Not all follow the same standard and some implement proprietary protocols. The Mifare cards are built upon the 14a standard and have additional commands which can be found in their specific directory.

	You usually start with the '''hf search''' command, which sends the card some data and analyses the return messages of the card. With this information the Proxmark3 can make assumptions on what kind of card it may be.		You usually start with the '''hf search''' command, which sends the card some data and analyses the return messages of the card. With this information, the Proxmark3 can make assumptions on what kind of card it may be.

	proxmark3> hf search		proxmark3> hf search
Line 128:		Line 128:
	Valid ISO14443A Tag Found - Quiting Search		Valid ISO14443A Tag Found - Quiting Search

	Here we see that this card is classified as a Mifare Classic 1k. In ~~particularly~~ it also answers back to the Chinese magic backdoor command which tells us that this card is a fully cloneable card ~~which~~ allows us to change the UID block of the card. More on this can be found in the Documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]		Here we see that this card is classified as a Mifare Classic 1k. In particular, it also answers back to the Chinese magic backdoor command which tells us that this card is a fully cloneable card that allows us to change the UID block of the card. More on this can be found in the Documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]

	We can now issue the '''hf plot''' command which will display a waveform with the just sent and received data.		We can now issue the '''hf plot''' command which will display a waveform with the just sent and received data.
Line 134:		Line 134:
	[[File:Waveform.PNG\|frameless]]		[[File:Waveform.PNG\|frameless]]

	Thankfully people wrote programs that will parse this data to a dedicated protocol ('''hf list'''). In this case we want to parse it as a Mifare classic communication with '''hf list mf'''.		Thankfully people wrote programs that will parse this data to a dedicated protocol ('''hf list'''). In this case, we want to parse it as a Mifare classic communication with '''hf list mf'''.

	proxmark3> hf list mf		proxmark3> hf list mf
Line 160:		Line 160:


	There are many more commands. For example, '''hf data''' to manipulate the raw data, or '''hf mf''' to interact with Mifare Classic cards. Since this is only a short introduction to commands of the Proxmark3 we won't go deeper. If one is interested and wants to find out more about the Proxmark you we highly recommend the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]] - where not only the essentials are covered, but also an in depth explanation about the technology used, the Proxmark itself, the Mifare Classic Standard and a validation of the FH-Campus card system.		There are many more commands. For example, '''hf data''' to manipulate the raw data, or '''hf mf''' to interact with Mifare Classic cards. Since this is only a short introduction to commands of the Proxmark3 we won't go deeper. If one is interested and wants to find out more about the Proxmark you we highly recommend the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]] - where not only the essentials are covered, but also an in-depth explanation about the technology used, the Proxmark itself, the Mifare Classic Standard and a validation of the FH-Campus card system.

	It is definitely worth checking out the paper, since it also shows which vulnerabilities ~~where~~ found in the school card system.		It is definitely worth checking out the paper since it also shows which vulnerabilities were found in the school card system.

	== Used Hardware ==		== Used Hardware ==

Jostrowski at 22:49, 29 January 2020

2020-01-29T22:49:54Z

← Older revision		Revision as of 22:49, 29 January 2020
Line 1:		Line 1:
	~~== Authors ==~~

	*Ostrowski, John
	*Arseven, Can

	== Summary ==		== Summary ==

Jostrowski at 19:33, 12 December 2019

2019-12-12T19:33:00Z

← Older revision		Revision as of 19:33, 12 December 2019
Line 27:		Line 27:

	=== The Commands ===		=== The Commands ===

			Connect via:
			: Linux: <code>./client/proxmark3 /dev/ttyACM0</code>
			: Windows <code>./client/proxmark3.exe COMx</code>

	After you have successfully completed the Install Proxmark3 guide, you should see a screen similar to this when connecting to your proxmark3:		After you have successfully completed the Install Proxmark3 guide, you should see a screen similar to this when connecting to your proxmark3:
Line 172:		Line 176:

	* [[Proxmark3: Installation]]		* [[Proxmark3: Installation]]
			* [[Proxmark3: FH-Campus Card NFC Security Valuation]]

	== References ==		== References ==

Silvie at 15:59, 25 July 2019

2019-07-25T15:59:27Z

← Older revision		Revision as of 15:59, 25 July 2019
Line 172:		Line 172:

	* [[Proxmark3: Installation]]		* [[Proxmark3: Installation]]
	* [[Proxmark3: FH-Campus Card NFC Security Valuation]]

	== References ==		== References ==

Jostrowski: Jostrowski moved page Proxmark3: Usefull commands to Proxmark3: Useful commands: Fix spelling

2019-07-23T11:54:30Z

Jostrowski moved page Proxmark3: Usefull commands to Proxmark3: Useful commands: Fix spelling

← Older revision	Revision as of 11:54, 23 July 2019
(No difference)

Carseven: /* Introduction */

2019-07-23T10:50:28Z

Introduction

← Older revision		Revision as of 10:50, 23 July 2019
Line 115:		Line 115:
	snoop <samples to skip (10000)> <triggers to skip (1)> Generic HF Snoop		snoop <samples to skip (10000)> <triggers to skip (1)> Generic HF Snoop

	~~Must~~ of these ~~group together different smart card manufactures~~. On the other hand 14a is a NFC card standard that describes low level communication of smart cards. Not all follow the same standard and some implement proprietary protocols. The Mifare cards are built upon the 14a standard and ~~has~~ additional commands which can be found in their specific directory.		Most of these command-options are for specific cards from specific manufacturers (e.g. legic, iclass, mf). On the other hand 14a is a NFC card standard that describes low level communication of smart cards. Not all follow the same standard and some implement proprietary protocols. The Mifare cards are built upon the 14a standard and have additional commands which can be found in their specific directory.

	You usually start with the '''hf search''' command~~. It~~ sends the card some data and analyses the return messages of the card. With this information it can make assumptions on what kind of card it may be.		You usually start with the '''hf search''' command, which sends the card some data and analyses the return messages of the card. With this information the Proxmark3 can make assumptions on what kind of card it may be.

	proxmark3> hf search		proxmark3> hf search
Line 129:		Line 129:
	Valid ISO14443A Tag Found - Quiting Search		Valid ISO14443A Tag Found - Quiting Search

	Here we see that this card is classified as a Mifare Classic 1k. In particularly it also answers back to the Chinese magic backdoor command which tells us that this card is a ~~clone~~ card which allows us to change the UID block of the card. More on this can be found in the Documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]		Here we see that this card is classified as a Mifare Classic 1k. In particularly it also answers back to the Chinese magic backdoor command which tells us that this card is a fully cloneable card which allows us to change the UID block of the card. More on this can be found in the Documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]

	We can now issue the '''hf plot''' command which will display a waveform with the just sent and received data.		We can now issue the '''hf plot''' command which will display a waveform with the just sent and received data.

Jostrowski: Format

2019-07-22T12:19:14Z

Format

← Older revision		Revision as of 12:19, 22 July 2019
Line 162:		Line 162:

	There are many more commands. For example, '''hf data''' to manipulate the raw data, or '''hf mf''' to interact with Mifare Classic cards. Since this is only a short introduction to commands of the Proxmark3 we won't go deeper. If one is interested and wants to find out more about the Proxmark you we highly recommend the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]] - where not only the essentials are covered, but also an in depth explanation about the technology used, the Proxmark itself, the Mifare Classic Standard and a validation of the FH-Campus card system.		There are many more commands. For example, '''hf data''' to manipulate the raw data, or '''hf mf''' to interact with Mifare Classic cards. Since this is only a short introduction to commands of the Proxmark3 we won't go deeper. If one is interested and wants to find out more about the Proxmark you we highly recommend the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]] - where not only the essentials are covered, but also an in depth explanation about the technology used, the Proxmark itself, the Mifare Classic Standard and a validation of the FH-Campus card system.

	It is definitely worth checking out the paper, since it also shows which vulnerabilities where found in the school card system.		It is definitely worth checking out the paper, since it also shows which vulnerabilities where found in the school card system.

Jostrowski: Add final

2019-07-22T12:18:29Z

Add final

← Older revision		Revision as of 12:18, 22 July 2019
Line 47:		Line 47:
	==== command: hw ====		==== command: hw ====

	hw stands for hardware and lists a bunch of commands to get basic hardware information of the Proxmark3.		"hw" stands for hardware and lists a bunch of commands to get basic hardware information of the Proxmark3.

	detectreader ['l'\|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)		detectreader ['l'\|'h'] -- Detect external reader field (option 'l' or 'h' to limit to LF or HF)
Line 71:		Line 71:
	fpga_hf.bit built for 2s30vq100 on 2019/03/20 at 08:08:07		fpga_hf.bit built for 2s30vq100 on 2019/03/20 at 08:08:07

	We can now check the antenna strength of the attached antennas. If you have borrowed the proxmark3 of the Elvis IoT Lab you will get following output		We can now check the antenna strength of the attached antennas. If you have borrowed the proxmark3 of the Elvis IoT Lab you will get following output:

	(If no smart card is in proximity):		(If no smart card is in proximity):
Line 94:		Line 94:

	==== command: hf ====		==== command: hf ====
	hf stands for high frequency, which are specified at a carrier frequency of about 13.56 MHz.		"hf" stands for high frequency, which are specified at a carrier frequency of about 13.56 MHz.
	Possible commands that can be issued:		Possible commands that can be issued are listed below:

	proxmark3> hf		proxmark3> hf
Line 117:		Line 117:
	Must of these group together different smart card manufactures. On the other hand 14a is a NFC card standard that describes low level communication of smart cards. Not all follow the same standard and some implement proprietary protocols. The Mifare cards are built upon the 14a standard and has additional commands which can be found in their specific directory.		Must of these group together different smart card manufactures. On the other hand 14a is a NFC card standard that describes low level communication of smart cards. Not all follow the same standard and some implement proprietary protocols. The Mifare cards are built upon the 14a standard and has additional commands which can be found in their specific directory.

	You usually start with the '''hf search''' command. It sends the card some data and analyses the return messages of the ~~smart~~ card. With this information it can make assumptions on what kind of card it may be.		You usually start with the '''hf search''' command. It sends the card some data and analyses the return messages of the card. With this information it can make assumptions on what kind of card it may be.

	proxmark3> hf search		proxmark3> hf search
Line 135:		Line 135:
	[[File:Waveform.PNG\|frameless]]		[[File:Waveform.PNG\|frameless]]

	Thankfully people wrote programs that will parse this data a dedicated protocol ('''hf list'''). In this case we want to parse it as a Mifare classic communication with '''hf list mf'''.		Thankfully people wrote programs that will parse this data to a dedicated protocol ('''hf list'''). In this case we want to parse it as a Mifare classic communication with '''hf list mf'''.

	proxmark3> hf list mf		proxmark3> hf list mf
Line 158:		Line 158:
	54196 \| 58932 \| Tag \| 01 20 01 45 \| \| AUTH: nt		54196 \| 58932 \| Tag \| 01 20 01 45 \| \| AUTH: nt

	~~... to~~ be ~~continued~~		More on what is happening here can be found in the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]]


	~~Furthermore~~, ~~when in~~ the ~~main menu (which~~ we ~~are after connecting~~ to the Proxmark3~~) you should distinguish between Low~~-~~Frequency (LF) and High~~-~~Frequency (HF) tags (~~the ~~exact meaning is further detailed~~ in ~~our documentation). Therefore~~ the ~~commands are split into hf~~ and ~~lf commands. If you have~~ a ~~Mifare~~ card~~, they are typically HF cards~~. ~~Try it by holding the card near your reader and type:~~		There are many more commands. For example, '''hf data''' to manipulate the raw data, or '''hf mf''' to interact with Mifare Classic cards. Since this is only a short introduction to commands of the Proxmark3 we won't go deeper. If one is interested and wants to find out more about the Proxmark you we highly recommend the documentation [[Proxmark3: FH-Campus Card NFC Security Valuation]] - where not only the essentials are covered, but also an in depth explanation about the technology used, the Proxmark itself, the Mifare Classic Standard and a validation of the FH-Campus card system.
			It is definitely worth checking out the paper, since it also shows which vulnerabilities where found in the school card system.
	~~> hf search~~

	~~HF search~~ is ~~a supposedly easy command~~, ~~though~~ it ~~holds a lot of background information~~ which ~~is essential for successful NFC hacking~~. ~~By now you should see an output which looks similar to this:~~

	~~> hf search~~
	~~UID : 12 34 56 78~~
	~~ATQA : 00 04~~
	~~SAK : 20 [1]~~
	~~TYPE : NXP MIFARE XX~~


	== Used Hardware ==		== Used Hardware ==
Line 181:		Line 171:

	* [[Proxmark3: Installation]]		* [[Proxmark3: Installation]]
			* [[Proxmark3: FH-Campus Card NFC Security Valuation]]

	== References ==		== References ==